From 70d5c2746afee9c2b6112246ab1640aa0ebb34c5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= Date: Thu, 6 Oct 2016 14:51:26 +0200 Subject: [PATCH 2/2] The new syntax for the protocols is TLSv1_1 instead of TLSv11 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This is a part of these commits ported to 1.94: commit 5c2151176da6a37e7dd16fd2ffc39809f58f6035 Author: Steffen Ullrich Date: Wed Jan 15 12:33:49 2014 +0100 1.964: get_sslversion* function, disabling TLS1_1 fixed - Disabling TLSv1_1 did not work, because the constant was wrong. Now it gets the constants from calling Net::SSLeay::SSL_OP_NO_TLSv1_1 etc - The new syntax for the protocols is TLSv1_1 instead of TLSv11. This matches the syntax from OpenSSL. The old syntax continues to work in SSL_version. - New functions get_sslversion and get_sslversion_int which get the SSL version of the establish session as string or int. - disable t/io-socket-inet6.t if Acme::Override::INET is installed commit bd49a91f755e5027ba5aa1656f32f86486f5c0fd Author: Steffen Ullrich Date: Tue Jan 21 17:53:15 2014 +0100 1.966 - fixed bug introduced in 1.964 - disabling TLSv1_2 worked no longer with specifying !TLSv12, only !TLSv1_2 worked - fixed leak of session objects in SessionCache, if another session replaced an existing session (introduced in 1.965) Signed-off-by: Petr Písař --- lib/IO/Socket/SSL.pm | 62 ++++++++++++++++++++++++++++------------------------ 1 file changed, 34 insertions(+), 28 deletions(-) diff --git a/lib/IO/Socket/SSL.pm b/lib/IO/Socket/SSL.pm index a30ffb1..4720606 100644 --- a/lib/IO/Socket/SSL.pm +++ b/lib/IO/Socket/SSL.pm @@ -61,6 +61,15 @@ BEGIN{ if $@; } +# get constants for SSL_OP_NO_* now, instead calling the releated functions +# everytime we setup a connection +my %SSL_OP_NO; +for(qw( SSLv2 SSLv3 TLSv1 TLSv1_1 TLSv11:TLSv1_1 TLSv1_2 TLSv12:TLSv1_2 )) { + my ($k,$op) = m{:} ? split(m{:},$_,2) : ($_,$_); + my $sub = "Net::SSLeay::OP_NO_$op"; + $SSL_OP_NO{$k} = eval { no strict 'refs'; &$sub } || 0; +} + our $DEBUG; use vars qw(@ISA $SSL_ERROR @EXPORT ); @@ -1582,32 +1591,27 @@ sub new { my $ver=''; my $disable_ver = 0; for (split(/\s*:\s*/,$arg_hash->{SSL_version})) { - m{^(!?)(?:(SSL(?:v2|v3|v23|v2/3))|(TLSv1[12]?))$}i + m{^(!?)(?:(SSL(?:v2|v3|v23|v2/3))|(TLSv1(?:_?[12])?))$}i or croak("invalid SSL_version specified"); my $not = $1; ( my $v = lc($2||$3) ) =~s{^(...)}{\U$1}; - $v =~s{/}{}; # interpret SSLv2/3 as SSLv23 if ( $not ) { - $disable_ver |= - $v eq 'SSLv2' ? 0x01000000 : # SSL_OP_NO_SSLv2 - $v eq 'SSLv3' ? 0x02000000 : # SSL_OP_NO_SSLv3 - $v eq 'TLSv1' ? 0x04000000 : # SSL_OP_NO_TLSv1 - $v eq 'TLSv11' ? 0x00000400 : # SSL_OP_NO_TLSv1_1 - $v eq 'TLSv12' ? 0x08000000 : # SSL_OP_NO_TLSv1_2 - croak("cannot disable version $_"); + $disable_ver |= $SSL_OP_NO{$v}; } else { croak("cannot set multiple SSL protocols in SSL_version") if $ver && $v ne $ver; $ver = $v; + $ver =~s{/}{}; # interpret SSLv2/3 as SSLv23 + $ver =~s{(TLSv1)(\d)}{$1\_$2}; # TLSv1_1 } } my $ctx_new_sub = UNIVERSAL::can( 'Net::SSLeay', - $ver eq 'SSLv2' ? 'CTX_v2_new' : - $ver eq 'SSLv3' ? 'CTX_v3_new' : - $ver eq 'TLSv1' ? 'CTX_tlsv1_new' : - $ver eq 'TLSv11' ? 'CTX_tlsv1_1_new' : - $ver eq 'TLSv12' ? 'CTX_tlsv1_2_new' : + $ver eq 'SSLv2' ? 'CTX_v2_new' : + $ver eq 'SSLv3' ? 'CTX_v3_new' : + $ver eq 'TLSv1' ? 'CTX_tlsv1_new' : + $ver eq 'TLSv1_1' ? 'CTX_tlsv1_1_new' : + $ver eq 'TLSv1_2' ? 'CTX_tlsv1_2_new' : 'CTX_new' ) or return IO::Socket::SSL->error("SSL Version $ver not supported"); my $ctx = $ctx_new_sub->() or return @@ -2064,24 +2068,26 @@ See section "SNI Support" for details of SNI the support. =item SSL_version -Sets the version of the SSL protocol used to transmit data. 'SSLv23' auto-negotiates -between SSLv2 and SSLv3, while 'SSLv2', 'SSLv3', 'TLSv1', 'TLSv11' or 'TLSv12' -restrict the protocol to the specified version. All values are case-insensitive. -Support for 'TLSv11' and 'TLSv12' requires recent versions of Net::SSLeay -and openssl. +Sets the version of the SSL protocol used to transmit data. +'SSLv23' auto-negotiates between SSLv2 and SSLv3, while 'SSLv2', 'SSLv3', +'TLSv1', 'TLSv1_1' or 'TLSv1_2' restrict the protocol to the specified version. +All values are case-insensitive. Instead of 'TLSv1_1' and 'TLSv1_2' one can +also use 'TLSv11' and 'TLSv12'. Support for 'TLSv1_1' and 'TLSv1_2' requires +recent versions of Net::SSLeay and openssl. You can limit to set of supported protocols by adding !version separated by ':'. The default SSL_version is defined by underlying cryptographic library. -E.g. 'SSLv23:!SSLv2' means, that SSLv2, SSLv3 and TLSv1 -are supported for initial protocol handshakes, but SSLv2 will not be accepted, leaving -only SSLv3 and TLSv1. You can also use !TLSv11 and !TLSv12 to disable TLS versions -1.1 and 1.2 while allowing TLS version 1.0. - -Setting the version instead to 'TLSv1' will probably break interaction with lots of -clients which start with SSLv2 and then upgrade to TLSv1. On the other side some -clients just close the connection when they receive a TLS version 1.1 request. In this -case setting the version to 'SSLv23:!SSLv2:!TLSv11:!TLSv12' might help. +E.g. 'SSLv23:!SSLv2' means, that SSLv2, SSLv3 and +TLSv1 are supported for initial protocol handshakes, but SSLv2 will not be +accepted, leaving only SSLv3 and TLSv1. You can also use !TLSv1_1 and !TLSv1_2 +to disable TLS versions 1.1 and 1.2 while allowing TLS version 1.0. + +Setting the version instead to 'TLSv1' will probably break interaction with +lots of clients which start with SSLv2 and then upgrade to TLSv1. On the other +side some clients just close the connection when they receive a TLS version 1.1 +request. In this case setting the version to 'SSLv23:!SSLv2:!TLSv1_1:!TLSv1_2' +might help. =item SSL_cipher_list -- 2.7.4